Get Ready For Email-Malware Spree

A sizeable uptick in malicious email attachments is just subsiding, but if history is any indicator,several smaller spikes are about to follow that use even more deceptive tactics than their predecessors.

The recent surge, fueled in large part by a flood of fake messages from UPS, is similar to one observed at the end of March in that the messages urge recipients to open an attachment that releases the malware on victims’ machines, according to Internet security firm Commtouch.

The earlier wave used a wide range of package-delivery services as senders, including FedEx and DHL, but the latest outbreak employs a wider variety of messages such as, “Dear client, recipient’s address is wrong”, “Dear User, Delivery Confirmation: FAILED”, and “Dear Client, We are not able to delivery [sic] the postal package”, according to the Commtouch blog.

All the messages then instruct the recipient to open the attachment that contains the malware, claiming it is an invoice or a form that needs to be filled out. “This time we see differences in the style of the emails – there is far more variation in the automatically-generated subjects, body and attachment names. Last time all the attachments were “UPS.exe” – this time there are many variations,” says Avi Turiel, director of product marketing at Commtouch in an email.

The attackers will evaluate the success of the attack by finding out how many recipients activated the malware, “Based on the infections vs. malware sent out they will probably try and figure out what they could improve in the next attack,” he says.

Read More…

Does Linkedin Share User Data?

Linkedin has upset many of its 100 million users by opting them into a programme that reveals their personal details to advertisers without telling anyone about it.

Linkedin changed its privacy policy to allow it to display the names and pictures of users with ads. The system works by showing friends and colleagues who’ve followed a brand name, effectively making them an unwitting salesperson for that brand, since people are more likely to click such advertisements on the basis that it looks like someone they know is recommending them. In reality, the other person has no idea that their photo and name are being used to sell things.

It’s a clever approach to advertising, but an absolutely abyssmal approach to privacy, as Linkedin has decided to automatically opt-in all of its users without informing them of the change.

Users can opt out if they want, but the option is buried in the Settings page, a ploy similar to that used by Facebook to hide its privacy settings. The big problem here is that if users don’t know that their name and photo are being used in this way, then how can they opt out of it?

Linkedin could face legal trouble for this decision. Digital Trends reports it is likely that Linkedin broke Dutch privacy law, which requires user consent for employing user images with advertisements. It could also be brought up before the European Commission and the UK Information Commissioner’s Office (ICO).

Read More…

Sprint To Debut Cloud Services

Sprint will introduce cloud services to all sizes of businesses in the fourth quarter, a Sprint executive said on Wednesday.

A Sprint spokeswoman said more details would be announced at a later date, but confirmed the executive’s comments in an interview published Wednesday.

Paget Alves, head of Sprint business markets, said in the interview that Sprint’s offerings to businesses will include selling its network infrastructure as a service available on-demand.

Sprint will also offer software, security apps and Internet hosting.

Verizon and AT&T offer similar services, and Alves was said that the carriers are “in a unique position because our business is centered around the cloud.”

Sprint plans to offer services that rely on the company’s own data center, unlike Verizon, which is using capacity from Terremark, which Verizon purchased for $1.4 billion in January.

Read More…

China Debuts Apple iPhone Knock-Off

The latest version of Apple Inc’s popular iPhone has already hit the Chinese market — the counterfeit market that is.

The ‘hiPhone 5′ is selling for as little as 200 yuan ($31) on China’s top e-commerce platform Taobao, which is owned by Alibaba Group.

But one has to pay around 800 yuan for a more “genuine” one, according to some store representatives at a mobile phone market in Shanghai.

“Look at this. It’s not the same as the 300-400 yuan ones,” Shanghai-based daily Metro Express quoted a clerk as saying, pointing to one originally priced at 850 yuan.

The ‘hiPhone 5′ is based on leaked images of the yet-to-be-launched iPhone 5 and is thinner and with less rounded edges than the existing iPhone 4, according to the newspaper. However, it is extremely light, almost like a plastic toy, like most pirated mobile phones, it said.

Read More…

VoIP Ideal Platform For Controlling Botnets

Botnets and their masters can communicate with one other by calling into the same VoIP conference call and exchanging data using touch tones, researchers demonstrated at Defcon.

This gives the botmasters — whose top goals include remaining anonymous — the ability to issue orders from random payphones and disposable cellular phones, say researchers Itzik Kotler and Iftach Ian Amit of security and risk-assessment firm Security Art.

Using phones and the public phone networks eliminates one of the prime tools bot fighters have: taking down the domains of botnets’ command and control servers, the researchers say. If the botmaster isn’t using a command and control server, it can’t be taken down.

In fact, the botmaster can communicate with the zombie machines that make up the botnet without using the Internet at all if the zombies are within a corporate network. So even if a victim company’s VoIP network is segregated from the data network, there is still a connection to the outside world.

In addition to its stealth, the VoIP tactic employs technology that readily pierces corporate firewalls and uses only traffic that is difficult for data loss prevention software to peer into. The traffic is streamed audio, so data loss prevention scanners can’t recognize patterns of data they are supposed to filter, the researchers say.

The downsides of VoIP as a command channel are that it severely limits the number of zombie machines that can be contacted at once, and the rate at which stolen data can be sent out of a corporate network is limited by the phone system. But Kotler and Amit say the connections are plenty big to send commands in.

During their demo at the conference, the pair had an Asterisk open source IP PBX stand in as the corporate PBX. A virtual machine representing a zombie computer on a corporate network called via TCP/IP through the PBX and into a corporate conference call. A BlackBerry, representing the botmaster dialed in over the public phone network to the same conference call.

Read More…

India Wants To Monitor Twitter & Facebook

India’s Communications Ministry has received a request from the Home Ministry to monitor social networking websites such as Twitter and Facebook amid fears that the services are being used by terrorists to organize attacks.

The request suggests that the Indian government is trying to expand the scope of its online surveillance for national security purposes.

Telecommunications service providers in India provide facilities for lawful interception and monitoring of communications on their network, including communications from social networking websites such as Facebook and Twitter, in accordance with their license agreements, Milind Deora, the minister of state for communications and IT, told Parliament, according to the country’s Press Information Bureau.

But there are certain communications which are encrypted, Deora said Friday.

The government did not provide details of what encrypted data they would like to have access to. A spokesman for the home ministry said on Monday that additional
information can only be provided in Parliament while it is in session.

Under new rules to the country’s IT Act that came into force earlier this year, websites and service providers are required to provide government security agencies with information on private accounts, including passwords, on request without a court order.

Most companies, however, are not willing to share information with law enforcement agencies unless they have a court order.

Twitter states in its guidelines for law enforcement that “non-public information about Twitter users is not released unless we have received a subpoena, court order, or other valid legal process document.”

Read More…

Lightning Took Down Amazon, Microsoft Clouds

A lightning strike in Dublin on Sunday caused a power outage in data centers belonging to Amazon and Microsoft, causing the companies’ cloud services to go offline.

Lightning hit a transformer, sparking an explosion and fire which caused the power outage at 10:41 AM PDT, according to preliminary information, Amazon wrote on its Service Health Dashboard. Under normal circumstances, backup generators would seamlessly kick in, but the explosion also managed to disable some of those generators.

By 1:56 PM PDT, power to the majority of network devices had been restored, allowing Amazon to focus on bringing EC2 (Elastic Compute Cloud) instances and EBS (Elastic Block Storage) volumes back online. But progress was slower than expected, Amazon said a couple of hours later.

“We know many of you are anxiously waiting for your instances and volumes to become available, and we want to give you more detail on why the recovery of the remaining instances and volumes is taking so long,” the company wrote at 11:04 PM PDT. “Due to the scale of the power disruption, a large number of EBS servers lost power and require manual operations before volumes can be restored … While many volumes will be restored over the next several hours, we anticipate that it will take 24-48 hours until the process is completed.”

Read More…

Apple Tech Support Satisfaction Plummets

Apple customers are increasingly unhappy with the company’s technical support, which could affect the firm’s bottom line in the future, a researcher said today.

Although Apple continues to outperform rival computer makers Hewlett-Packard and Dell in overall customer satisfaction with technical support, in several areas Apple’s slippage over the last year is alarming, said Peter Leppik, CEO of Vocalabs, a Minneapolis-based company that surveys consumers after they’ve contacted customer or technical support.

“Apple is still definitely ahead of its competition, but what we are highlighting are deeper metrics that are showing negative trends,” said Leppik. “Customers are upset with the automated part of support calls to Apple, and that might be trickling into higher metrics.”

Those higher metrics Leppik referenced include the likelihood customers will return for another purchase in the future, or continue to recommend Apple products to friends and family.

In the past 12 months, consumers who said they were “very satisfied” with Apple’s technical support dropped 15 percentage points, from 73% at the mid-point of 2010 to 58% halfway through 2011, said Leppik.

The primary cause of the tumble was a turnabout in customers’ opinion of the automated section of their calls to Apple. In the last year, the percentage of those who said they were very satisfied with the quality of Apple’s automation fell 13 points to 24%. That’s a new low for Apple in Vocalabs surveys, and a whopping 28 points off the peak of 52% a year-and-a-half ago.

Read More….

Poor Get Online With Cloud Phone

Start up firm Movirtu has made plans to help 3 million or more people in poor countries use mobile services by giving them personal phone numbers, not phones.

Working with a U.N.-affiliated initiative called Business Call to Action (BCtA), Movirtu will offer the numbers, which it calls mobile identities, through commercial carriers in developing countries in Africa and South Asia. People in those countries who typically borrow phones from others will be able to log into the carrier’s network and use their own prepaid minutes and bits of data. The service is called Cloud Phone, though it operates within a carrier’s own infrastructure rather than on the Internet as a classic cloud service would.

Having a personal mobile identity can save users money in two ways, according to Ramona Liberoff, executive vice president of marketing, strategy and planning at Movirtu. First, they can use mobile services without buying a phone, which is a luxury even at US$15 or $20 for people making $1 or $2 per day. Second, the cost of prepaid service from a carrier typically is less than what consumers in those countries pay someone to borrow a phone, she said.

Though it’s customary in many of these countries to lend a phone to someone in need, the borrower is also expected to pay the lender for the usage. The average savings from using regular prepaid service instead is estimated at about $60 per year, Liberoff said.

The service will help people to use mobile banking, insurance and farming assistance services as well as make phone calls, Liberoff said.

Some of these services currently can only be delivered to individuals and not to someone sharing a phone. Personal mobile identities could be a boon to NGOs (non-governmental organizations) that want to use mobile technology. “In many cases, there are great NGO programs that can’t reach 80 percent of their base,” because those people don’t have their own phones, Liberoff said.

Read More…

ISPs Close Internet Gap

Broadband speeds on average are within 80 percent of what major Internet service providers advertise, an appreciable increase from two years ago, according to a government study.

The Federal Communications Commission studied cable, DSL and fiber-to-the-home services at 13 top U.S. broadband providers.

The FCC found Verizon Communications Inc’s fiber network was best at meeting or exceeding advertised maximum download speeds, while Cablevision Systems Corp came in last place.

Overall, the numbers were a big boost from 2009, when data indicated download speeds were often about half of Internet service providers’ (ISP) maximum advertised speeds.

“Most major ISPs are providing service close to what they’re advertising. This represents a significant improvement over the findings from two years ago when we first shined a light on this issue,” FCC Chairman Julius Genachowski said, unveiling the study’s findings at a Best Buy Co store in the District of Columbia.

During peak consumer usage hours when networks are busiest, actual download speeds varied from 114 percent to 54 percent of advertised speed among the different ISPs, the FCC said.

The complete findings of the report, its raw data and an FCC-prepared guide for consumers will be made available online. The FCC says the data will help consumers decide which Internet speed, service and provider best meet their needs.

“This report pretty well dispels the myth … that there’s a huge gap between advertised and actual speeds, and in fact we do pretty well here in the United States,” said Richard Bennett, a senior fellow at the Information Technology and Innovation Foundation.

Not everyone was impressed with the study’s findings.

Read More….

« Previous Page — Next Page »